diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c
index 9aef2f7d7..d6f8b0341 100644
--- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c
+++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c
@@ -517,6 +517,7 @@ static int ipapwd_pre_mod(Slapi_PBlock *pb)
             /* check op filtering out LDAP_MOD_BVALUES */
             switch (lmod->mod_op & 0x0f) {
             case LDAP_MOD_ADD:
+            case LDAP_MOD_REPLACE:
                 if (!lmod->mod_bvalues ||
                     !lmod->mod_bvalues[0]) {
                     rc = LDAP_OPERATIONS_ERROR;
@@ -528,8 +529,8 @@ static int ipapwd_pre_mod(Slapi_PBlock *pb)
                     (strncmp(NTHASH_REGEN_VAL,
                              bv->bv_val, bv->bv_len) == 0)) {
                     is_magic_regen = 1;
-                    /* make sure the database will later ignore this mod */
-                    slapi_mods_remove(smods);
+		    /* We do not remove the mod from the list due to
+		     * https://pagure.io/389-ds-base/issue/387#comment-120145 */
                 }
             default:
                 break;
@@ -1009,7 +1010,9 @@ static int ipapwd_regen_nthash(Slapi_PBlock *pb, Slapi_Mods *smods,
         bval.bv_len = 16;
         ntvals[0] = &bval;
 
-        slapi_mods_add_modbvps(smods, LDAP_MOD_ADD, "ipaNTHash", ntvals);
+	/* add the change as a replace operation due to
+	 * https://pagure.io/389-ds-base/issue/387#comment-120145 */
+        slapi_mods_add_modbvps(smods, LDAP_MOD_REPLACE, "ipaNTHash", ntvals);
 
         ret = LDAP_SUCCESS;
         break;
diff --git a/ipatests/test_cmdline/test_ipagetkeytab.py b/ipatests/test_cmdline/test_ipagetkeytab.py
index deb9e5f84..7c613dfc5 100644
--- a/ipatests/test_cmdline/test_ipagetkeytab.py
+++ b/ipatests/test_cmdline/test_ipagetkeytab.py
@@ -390,7 +390,6 @@ def test_smb_svc(request, test_host):
 
 
 @pytest.mark.tier0
-@pytest.mark.xfail(reason="freeipa ticket 7953", strict=True)
 @pytest.mark.skipif(u'ipantuserattrs' not in add_oc([], u'ipantuserattrs'),
                     reason="Must have trust support enabled for this test")
 class test_smb_service(KeytabRetrievalTest):